Analysis
-
max time kernel
120s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
26-12-2024 04:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
c7c1aad82f6a1e9216b0dc2f77548e6a58dc7aca7023676e7b18ef423cc2252b.exe
Resource
win7-20241010-en
windows7-x64
7 signatures
120 seconds
General
-
Target
c7c1aad82f6a1e9216b0dc2f77548e6a58dc7aca7023676e7b18ef423cc2252b.exe
-
Size
454KB
-
MD5
92f17e71b40b4d85ea4357514506b3d8
-
SHA1
699da613e097a661464b5c7dbc097537baae99f9
-
SHA256
c7c1aad82f6a1e9216b0dc2f77548e6a58dc7aca7023676e7b18ef423cc2252b
-
SHA512
0060cc946c8b2e9c230a1b7913a5fc56598af747160ef6f38ee9ce11ef8e779f6b14b54e04bb999981d7fa29302b14e82809176b3c4f804dfb4dc70e8ea7ed4e
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeI:q7Tc2NYHUrAwfMp3CDI
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 63 IoCs
resource yara_rule behavioral2/memory/4968-5-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4308-13-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2428-18-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3320-25-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3480-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3604-37-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1220-43-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4404-50-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4108-52-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3740-64-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3324-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1136-73-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2596-83-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3624-90-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/344-96-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4212-101-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4472-106-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4220-117-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2260-125-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4280-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1752-134-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3364-150-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1464-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3300-159-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1816-183-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3008-176-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4700-191-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4796-198-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4892-202-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2044-212-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5116-218-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3112-222-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3036-232-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4948-238-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2948-245-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4380-261-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2340-265-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1072-272-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2488-279-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1568-283-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2880-293-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1220-297-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/948-301-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4920-317-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/5064-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3920-340-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1876-350-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3116-360-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2364-379-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2032-386-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3180-390-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/2084-400-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3892-410-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3024-435-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3132-448-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1476-480-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4960-496-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3000-554-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3092-660-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4108-733-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/4516-827-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/1692-840-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral2/memory/3132-1489-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 4308 1jppp.exe 2428 ppvdd.exe 3320 hhnhhh.exe 3480 rfrxrrx.exe 3604 ddjjp.exe 1220 ththtt.exe 4404 rrxxrxx.exe 4108 vdddj.exe 3324 xxlrrxf.exe 3740 lfxffrr.exe 1136 nntnhb.exe 3212 5rxrlll.exe 2596 1pvvv.exe 3624 llrrxxf.exe 344 vdppd.exe 4212 frfxrrx.exe 4472 pjpjd.exe 5084 7xxxrrr.exe 4220 pjddd.exe 2260 5rrlflf.exe 4720 tnttnb.exe 1752 7pvvp.exe 4280 lfrffff.exe 772 bhtnhh.exe 3364 thtnnt.exe 1464 rxrrxxf.exe 3300 dddpv.exe 2920 llrffxx.exe 5108 bhnhtt.exe 3008 ddjjv.exe 1816 lxfrllf.exe 4700 nnbtnn.exe 756 dvvdd.exe 4796 vdddj.exe 4892 vdpvv.exe 4064 rfxrllf.exe 1840 7hthbt.exe 2044 dvvpj.exe 3532 lxxrfxr.exe 5116 lxfxlxr.exe 3112 tbbhhn.exe 4772 dpdvv.exe 5060 lrlxfff.exe 3036 bbhhnt.exe 2648 tttnbb.exe 4948 pjvjj.exe 4256 lxfxllr.exe 2948 thnbbt.exe 3128 5djdp.exe 3860 5pvpp.exe 1476 7fxrffx.exe 4000 thhtnh.exe 4380 vdjdv.exe 2340 9jvdv.exe 4968 lxxrlfx.exe 1072 tbbbbh.exe 3436 vvdjj.exe 2488 vdppj.exe 1568 7lrflrl.exe 4724 bbbhhh.exe 3504 vjvjj.exe 2880 pppdv.exe 1220 lxlfrrr.exe 948 bhnhhh.exe -
resource yara_rule behavioral2/memory/4968-5-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4308-13-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2428-11-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2428-18-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3320-25-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3604-32-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3480-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3604-37-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1220-43-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4404-50-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4108-52-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3740-64-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3324-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1136-73-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2596-83-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3624-90-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/344-96-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4212-101-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4472-106-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4220-117-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2260-125-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4280-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1752-134-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3364-150-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1464-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3300-159-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1816-183-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3008-176-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4700-191-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4796-198-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4892-202-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2044-212-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5116-218-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3112-222-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3036-232-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4948-238-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2948-245-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4380-261-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2340-265-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1072-272-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2488-279-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1568-283-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2880-293-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1220-297-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/948-301-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4920-317-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/5064-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3920-340-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1876-350-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3116-360-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2364-379-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2032-386-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3180-390-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/2084-400-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3892-410-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3024-435-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3132-448-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1476-480-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4960-496-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3000-554-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/3092-660-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4108-733-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/4516-827-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral2/memory/1692-840-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lrfrlff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vdppd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5vpjd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language thnhbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ntnnbb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xlfxrrr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rrrfffr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flxxfxf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tbbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3nnnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bbnntt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1jppp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xxrlll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdjjp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nbbtnn.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4968 wrote to memory of 4308 4968 c7c1aad82f6a1e9216b0dc2f77548e6a58dc7aca7023676e7b18ef423cc2252b.exe 82 PID 4968 wrote to memory of 4308 4968 c7c1aad82f6a1e9216b0dc2f77548e6a58dc7aca7023676e7b18ef423cc2252b.exe 82 PID 4968 wrote to memory of 4308 4968 c7c1aad82f6a1e9216b0dc2f77548e6a58dc7aca7023676e7b18ef423cc2252b.exe 82 PID 4308 wrote to memory of 2428 4308 1jppp.exe 83 PID 4308 wrote to memory of 2428 4308 1jppp.exe 83 PID 4308 wrote to memory of 2428 4308 1jppp.exe 83 PID 2428 wrote to memory of 3320 2428 ppvdd.exe 84 PID 2428 wrote to memory of 3320 2428 ppvdd.exe 84 PID 2428 wrote to memory of 3320 2428 ppvdd.exe 84 PID 3320 wrote to memory of 3480 3320 hhnhhh.exe 85 PID 3320 wrote to memory of 3480 3320 hhnhhh.exe 85 PID 3320 wrote to memory of 3480 3320 hhnhhh.exe 85 PID 3480 wrote to memory of 3604 3480 rfrxrrx.exe 86 PID 3480 wrote to memory of 3604 3480 rfrxrrx.exe 86 PID 3480 wrote to memory of 3604 3480 rfrxrrx.exe 86 PID 3604 wrote to memory of 1220 3604 ddjjp.exe 87 PID 3604 wrote to memory of 1220 3604 ddjjp.exe 87 PID 3604 wrote to memory of 1220 3604 ddjjp.exe 87 PID 1220 wrote to memory of 4404 1220 ththtt.exe 88 PID 1220 wrote to memory of 4404 1220 ththtt.exe 88 PID 1220 wrote to memory of 4404 1220 ththtt.exe 88 PID 4404 wrote to memory of 4108 4404 rrxxrxx.exe 89 PID 4404 wrote to memory of 4108 4404 rrxxrxx.exe 89 PID 4404 wrote to memory of 4108 4404 rrxxrxx.exe 89 PID 4108 wrote to memory of 3324 4108 vdddj.exe 90 PID 4108 wrote to memory of 3324 4108 vdddj.exe 90 PID 4108 wrote to memory of 3324 4108 vdddj.exe 90 PID 3324 wrote to memory of 3740 3324 xxlrrxf.exe 91 PID 3324 wrote to memory of 3740 3324 xxlrrxf.exe 91 PID 3324 wrote to memory of 3740 3324 xxlrrxf.exe 91 PID 3740 wrote to memory of 1136 3740 lfxffrr.exe 92 PID 3740 wrote to memory of 1136 3740 lfxffrr.exe 92 PID 3740 wrote to memory of 1136 3740 lfxffrr.exe 92 PID 1136 wrote to memory of 3212 1136 nntnhb.exe 93 PID 1136 wrote to memory of 3212 1136 nntnhb.exe 93 PID 1136 wrote to memory of 3212 1136 nntnhb.exe 93 PID 3212 wrote to memory of 2596 3212 5rxrlll.exe 94 PID 3212 wrote to memory of 2596 3212 5rxrlll.exe 94 PID 3212 wrote to memory of 2596 3212 5rxrlll.exe 94 PID 2596 wrote to memory of 3624 2596 1pvvv.exe 95 PID 2596 wrote to memory of 3624 2596 1pvvv.exe 95 PID 2596 wrote to memory of 3624 2596 1pvvv.exe 95 PID 3624 wrote to memory of 344 3624 llrrxxf.exe 96 PID 3624 wrote to memory of 344 3624 llrrxxf.exe 96 PID 3624 wrote to memory of 344 3624 llrrxxf.exe 96 PID 344 wrote to memory of 4212 344 vdppd.exe 97 PID 344 wrote to memory of 4212 344 vdppd.exe 97 PID 344 wrote to memory of 4212 344 vdppd.exe 97 PID 4212 wrote to memory of 4472 4212 frfxrrx.exe 98 PID 4212 wrote to memory of 4472 4212 frfxrrx.exe 98 PID 4212 wrote to memory of 4472 4212 frfxrrx.exe 98 PID 4472 wrote to memory of 5084 4472 pjpjd.exe 99 PID 4472 wrote to memory of 5084 4472 pjpjd.exe 99 PID 4472 wrote to memory of 5084 4472 pjpjd.exe 99 PID 5084 wrote to memory of 4220 5084 7xxxrrr.exe 100 PID 5084 wrote to memory of 4220 5084 7xxxrrr.exe 100 PID 5084 wrote to memory of 4220 5084 7xxxrrr.exe 100 PID 4220 wrote to memory of 2260 4220 pjddd.exe 101 PID 4220 wrote to memory of 2260 4220 pjddd.exe 101 PID 4220 wrote to memory of 2260 4220 pjddd.exe 101 PID 2260 wrote to memory of 4720 2260 5rrlflf.exe 102 PID 2260 wrote to memory of 4720 2260 5rrlflf.exe 102 PID 2260 wrote to memory of 4720 2260 5rrlflf.exe 102 PID 4720 wrote to memory of 1752 4720 tnttnb.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\c7c1aad82f6a1e9216b0dc2f77548e6a58dc7aca7023676e7b18ef423cc2252b.exe"C:\Users\Admin\AppData\Local\Temp\c7c1aad82f6a1e9216b0dc2f77548e6a58dc7aca7023676e7b18ef423cc2252b.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4968 -
\??\c:\1jppp.exec:\1jppp.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4308 -
\??\c:\ppvdd.exec:\ppvdd.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
\??\c:\hhnhhh.exec:\hhnhhh.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
\??\c:\rfrxrrx.exec:\rfrxrrx.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
\??\c:\ddjjp.exec:\ddjjp.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
\??\c:\ththtt.exec:\ththtt.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
\??\c:\rrxxrxx.exec:\rrxxrxx.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
\??\c:\vdddj.exec:\vdddj.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4108 -
\??\c:\xxlrrxf.exec:\xxlrrxf.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3324 -
\??\c:\lfxffrr.exec:\lfxffrr.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
\??\c:\nntnhb.exec:\nntnhb.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1136 -
\??\c:\5rxrlll.exec:\5rxrlll.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
\??\c:\1pvvv.exec:\1pvvv.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
\??\c:\llrrxxf.exec:\llrrxxf.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
\??\c:\vdppd.exec:\vdppd.exe16⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:344 -
\??\c:\frfxrrx.exec:\frfxrrx.exe17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
\??\c:\pjpjd.exec:\pjpjd.exe18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
\??\c:\7xxxrrr.exec:\7xxxrrr.exe19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
\??\c:\pjddd.exec:\pjddd.exe20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
\??\c:\5rrlflf.exec:\5rrlflf.exe21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
\??\c:\tnttnb.exec:\tnttnb.exe22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
\??\c:\7pvvp.exec:\7pvvp.exe23⤵
- Executes dropped EXE
PID:1752 -
\??\c:\lfrffff.exec:\lfrffff.exe24⤵
- Executes dropped EXE
PID:4280 -
\??\c:\bhtnhh.exec:\bhtnhh.exe25⤵
- Executes dropped EXE
PID:772 -
\??\c:\thtnnt.exec:\thtnnt.exe26⤵
- Executes dropped EXE
PID:3364 -
\??\c:\rxrrxxf.exec:\rxrrxxf.exe27⤵
- Executes dropped EXE
PID:1464 -
\??\c:\dddpv.exec:\dddpv.exe28⤵
- Executes dropped EXE
PID:3300 -
\??\c:\llrffxx.exec:\llrffxx.exe29⤵
- Executes dropped EXE
PID:2920 -
\??\c:\bhnhtt.exec:\bhnhtt.exe30⤵
- Executes dropped EXE
PID:5108 -
\??\c:\ddjjv.exec:\ddjjv.exe31⤵
- Executes dropped EXE
PID:3008 -
\??\c:\lxfrllf.exec:\lxfrllf.exe32⤵
- Executes dropped EXE
PID:1816 -
\??\c:\nnbtnn.exec:\nnbtnn.exe33⤵
- Executes dropped EXE
PID:4700 -
\??\c:\dvvdd.exec:\dvvdd.exe34⤵
- Executes dropped EXE
PID:756 -
\??\c:\vdddj.exec:\vdddj.exe35⤵
- Executes dropped EXE
PID:4796 -
\??\c:\vdpvv.exec:\vdpvv.exe36⤵
- Executes dropped EXE
PID:4892 -
\??\c:\rfxrllf.exec:\rfxrllf.exe37⤵
- Executes dropped EXE
PID:4064 -
\??\c:\7hthbt.exec:\7hthbt.exe38⤵
- Executes dropped EXE
PID:1840 -
\??\c:\dvvpj.exec:\dvvpj.exe39⤵
- Executes dropped EXE
PID:2044 -
\??\c:\lxxrfxr.exec:\lxxrfxr.exe40⤵
- Executes dropped EXE
PID:3532 -
\??\c:\lxfxlxr.exec:\lxfxlxr.exe41⤵
- Executes dropped EXE
PID:5116 -
\??\c:\tbbhhn.exec:\tbbhhn.exe42⤵
- Executes dropped EXE
PID:3112 -
\??\c:\dpdvv.exec:\dpdvv.exe43⤵
- Executes dropped EXE
PID:4772 -
\??\c:\lrlxfff.exec:\lrlxfff.exe44⤵
- Executes dropped EXE
PID:5060 -
\??\c:\bbhhnt.exec:\bbhhnt.exe45⤵
- Executes dropped EXE
PID:3036 -
\??\c:\tttnbb.exec:\tttnbb.exe46⤵
- Executes dropped EXE
PID:2648 -
\??\c:\pjvjj.exec:\pjvjj.exe47⤵
- Executes dropped EXE
PID:4948 -
\??\c:\lxfxllr.exec:\lxfxllr.exe48⤵
- Executes dropped EXE
PID:4256 -
\??\c:\thnbbt.exec:\thnbbt.exe49⤵
- Executes dropped EXE
PID:2948 -
\??\c:\5djdp.exec:\5djdp.exe50⤵
- Executes dropped EXE
PID:3128 -
\??\c:\5pvpp.exec:\5pvpp.exe51⤵
- Executes dropped EXE
PID:3860 -
\??\c:\7fxrffx.exec:\7fxrffx.exe52⤵
- Executes dropped EXE
PID:1476 -
\??\c:\thhtnh.exec:\thhtnh.exe53⤵
- Executes dropped EXE
PID:4000 -
\??\c:\vdjdv.exec:\vdjdv.exe54⤵
- Executes dropped EXE
PID:4380 -
\??\c:\9jvdv.exec:\9jvdv.exe55⤵
- Executes dropped EXE
PID:2340 -
\??\c:\lxxrlfx.exec:\lxxrlfx.exe56⤵
- Executes dropped EXE
PID:4968 -
\??\c:\tbbbbh.exec:\tbbbbh.exe57⤵
- Executes dropped EXE
PID:1072 -
\??\c:\vvdjj.exec:\vvdjj.exe58⤵
- Executes dropped EXE
PID:3436 -
\??\c:\vdppj.exec:\vdppj.exe59⤵
- Executes dropped EXE
PID:2488 -
\??\c:\7lrflrl.exec:\7lrflrl.exe60⤵
- Executes dropped EXE
PID:1568 -
\??\c:\bbbhhh.exec:\bbbhhh.exe61⤵
- Executes dropped EXE
PID:4724 -
\??\c:\vjvjj.exec:\vjvjj.exe62⤵
- Executes dropped EXE
PID:3504 -
\??\c:\pppdv.exec:\pppdv.exe63⤵
- Executes dropped EXE
PID:2880 -
\??\c:\lxlfrrr.exec:\lxlfrrr.exe64⤵
- Executes dropped EXE
PID:1220 -
\??\c:\bhnhhh.exec:\bhnhhh.exe65⤵
- Executes dropped EXE
PID:948 -
\??\c:\tththb.exec:\tththb.exe66⤵PID:1252
-
\??\c:\jdjjd.exec:\jdjjd.exe67⤵PID:2908
-
\??\c:\lrfxrlf.exec:\lrfxrlf.exe68⤵PID:3324
-
\??\c:\xrlfxrl.exec:\xrlfxrl.exe69⤵PID:2712
-
\??\c:\tttnhb.exec:\tttnhb.exe70⤵PID:4920
-
\??\c:\ppvdv.exec:\ppvdv.exe71⤵PID:5064
-
\??\c:\nnthhh.exec:\nnthhh.exe72⤵PID:216
-
\??\c:\bbnhhh.exec:\bbnhhh.exe73⤵PID:2616
-
\??\c:\dddvd.exec:\dddvd.exe74⤵PID:2052
-
\??\c:\xfrrrlr.exec:\xfrrrlr.exe75⤵PID:3000
-
\??\c:\ffrlfxr.exec:\ffrlfxr.exe76⤵PID:212
-
\??\c:\7nnhhb.exec:\7nnhhb.exe77⤵PID:3920
-
\??\c:\djppj.exec:\djppj.exe78⤵PID:2380
-
\??\c:\3vvpj.exec:\3vvpj.exe79⤵PID:4212
-
\??\c:\xflllll.exec:\xflllll.exe80⤵PID:1876
-
\??\c:\thtnnh.exec:\thtnnh.exe81⤵PID:4076
-
\??\c:\3vdvj.exec:\3vdvj.exe82⤵PID:4128
-
\??\c:\flxrrrx.exec:\flxrrrx.exe83⤵PID:3116
-
\??\c:\frxxxxr.exec:\frxxxxr.exe84⤵PID:2036
-
\??\c:\5nnnbh.exec:\5nnnbh.exe85⤵PID:2344
-
\??\c:\pdddv.exec:\pdddv.exe86⤵PID:1752
-
\??\c:\9xfrfff.exec:\9xfrfff.exe87⤵PID:1716
-
\??\c:\rlfxlfx.exec:\rlfxlfx.exe88⤵PID:1480
-
\??\c:\3nttbb.exec:\3nttbb.exe89⤵PID:2364
-
\??\c:\3djjd.exec:\3djjd.exe90⤵PID:532
-
\??\c:\rllfrrl.exec:\rllfrrl.exe91⤵PID:2032
-
\??\c:\hnttnn.exec:\hnttnn.exe92⤵PID:3180
-
\??\c:\pvvpp.exec:\pvvpp.exe93⤵PID:5112
-
\??\c:\rrrrlrr.exec:\rrrrlrr.exe94⤵PID:3192
-
\??\c:\bbhbtt.exec:\bbhbtt.exe95⤵PID:2084
-
\??\c:\vdjpd.exec:\vdjpd.exe96⤵PID:1956
-
\??\c:\dvvpj.exec:\dvvpj.exe97⤵PID:3648
-
\??\c:\1xrlfff.exec:\1xrlfff.exe98⤵PID:3892
-
\??\c:\nhtnbb.exec:\nhtnbb.exe99⤵PID:4856
-
\??\c:\vvpjd.exec:\vvpjd.exe100⤵PID:2644
-
\??\c:\5xrlxrl.exec:\5xrlxrl.exe101⤵PID:3500
-
\??\c:\7bhbnn.exec:\7bhbnn.exe102⤵PID:720
-
\??\c:\vpvpj.exec:\vpvpj.exe103⤵PID:4540
-
\??\c:\xxllxxr.exec:\xxllxxr.exe104⤵PID:1516
-
\??\c:\btbbbb.exec:\btbbbb.exe105⤵PID:4484
-
\??\c:\5tntnn.exec:\5tntnn.exe106⤵PID:3024
-
\??\c:\jjpjp.exec:\jjpjp.exe107⤵PID:2076
-
\??\c:\rxlxrrl.exec:\rxlxrrl.exe108⤵PID:3972
-
\??\c:\nhbhnt.exec:\nhbhnt.exe109⤵PID:3092
-
\??\c:\bbbbbh.exec:\bbbbbh.exe110⤵PID:3132
-
\??\c:\7djjj.exec:\7djjj.exe111⤵PID:4616
-
\??\c:\xlrlffl.exec:\xlrlffl.exe112⤵PID:1968
-
\??\c:\tthhht.exec:\tthhht.exe113⤵PID:4104
-
\??\c:\ppvvp.exec:\ppvvp.exe114⤵PID:1308
-
\??\c:\frflfff.exec:\frflfff.exe115⤵PID:1612
-
\??\c:\btthbt.exec:\btthbt.exe116⤵PID:4312
-
\??\c:\dpdjj.exec:\dpdjj.exe117⤵PID:4088
-
\??\c:\ppvpv.exec:\ppvpv.exe118⤵PID:4084
-
\??\c:\rxfxrxl.exec:\rxfxrxl.exe119⤵PID:3860
-
\??\c:\tbbbbh.exec:\tbbbbh.exe120⤵PID:1476
-
\??\c:\djppp.exec:\djppp.exe121⤵PID:4376
-
\??\c:\xlrlffr.exec:\xlrlffr.exe122⤵PID:3124
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-